CVE-2025-42950CWE-94

Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)

Critical · published August 12, 2025

CVSS v3.1
9.9
EPSS
1%
Percentile
52.5
In the wild
Unconfirmed
What it is

🚨 A crafty user with privileges can exploit this SAP vulnerability, injecting arbitrary ABAP code right into the heart of your system! 🔥 Think of it like a restaurant where someone with a staff badge can sneak in their own ingredients — they might swap in something toxic without anyone noticing. This vulnerability lets attackers bypass crucial checks, serving up a dangerous meal to the system. The consequences of this vulnerability are absolutely devastating. An attacker could gain full control over the system, leading to unauthorized data access, data manipulation, and even complete system failure. Essentially, this flaw opens a backdoor that could undermine the very foundation of your security!

Put simply

Think of it like a restaurant where someone with a staff badge can sneak in their own ingredients — they might swap in something toxic without anyone noticing. This vulnerability lets attackers bypass crucial checks, serving up a dangerous meal to the system. This vulnerability in SAP Landscape Transformation (SLT) allows an attacker with user privileges to exploit a function module via RFC, injecting harmful ABAP code and bypassing critical authorization checks.

What to do

The consequences of this vulnerability are absolutely devastating. An attacker could gain full control over the system, leading to unauthorized data access, data manipulation, and even complete system failure. Essentially, this flaw opens a backdoor that could undermine the very foundation of your security! Immediately restrict access privileges to the SLT function module and apply any security patches released by SAP. Regularly audit user roles and monitor for any suspicious activity to ensure your system remains secure. Don't leave any doors open — secure that system! You've got this! Take these steps, and you'll lock down your system in no time. 🛡️

The record
Technical detail
CVSS v3.1
9.9 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00697 · 52.5th percentile
Weakness
CWE-94 · Improper Control of Generation of Code ('Code Injection')
Published
2025-08-12T02:08Z
EPSS history
Timeline
  • 12 AUG 02:08Z
    Code Injection Vulnerability in SAP Landscape Transformation (Analysis Platform)
    cvelistv5